+- Spiffy Hacks (https://spiffyhacks.harmonypogo.com)
+-- Forum: LeapFrog LeapPad (https://spiffyhacks.harmonypogo.com/forum-7.html)
+--- Forum: LeapTv (https://spiffyhacks.harmonypogo.com/forum-23.html)
+--- Thread: (de)bricking NOR flash on a dead LeapTV (/thread-877.html)
(de)bricking NOR flash on a dead LeapTV - jbevren - 01-18-2016
While attempting to get a more accessible u-boot setup, I entered a 'saveenv' command and reset the LeapTV. The system failed to boot after this.
Apparently U-Boot is misconfigured as it is in the LeapTV, as it saves its environment in NOR flash at 0x4000. There is binary code at that location, which prevents bootup when overwritten.
I used flashrom and a Raspberry Pi to reflash the NOR device by connecting to the test points surrounding U700 and powering the board up to ensure the IC has power.
Having a copy of /dev/mtd0 as a backup saved my day, and being able to read the NOR flash before writing it helped a lot as well. /dev/mtd0 only returns 504k, while the other 8k wasnt backed up by myself. Some binary slicing was done with my backup and the additional 8k of data, and rewritten to the NOR flash afterward. The LeapTV is alive again!
Code:
flashrom -p linux_spi:dev=/dev/spidev0.0 -r 2016010801.bin
dd if=2016010801.bin of=last8k.bin bs=516096 skip=1
cat mtd0 last8k.bin > rewrite.bin
flashrom -p linux_spi:dev=/dev/spidev0.0 -E
flashrom -p linux_spi:dev=/dev/spidev0.0 -w rewrite.binMy website at http://pix.jbevren.net/e/LTV/leaptv-debrick has my original post including a picture of the setup for reflashing. It went without a hitch in spite of flashrom's notes about the NOR chip being untested.
